Replace per-repo IAM roles with per-team roles#73
Merged
Conversation
IAM:
- Replace javabin-ci-app-{repo} with javabin-ci-team-{team}
- Replace javabin-ci-deploy-{repo} with javabin-ci-deploy-{team}
- Trust any javaBin/* repo via OIDC, pinned to platform workflow refs
(only our controlled workflows can assume these roles)
- ABAC scopes access by team tag instead of project tag
- registered_app_repos → registered_teams (synced from GitHub teams API)
Workflows:
- tf-plan, docker-build, ecs-deploy: resolve team from GitHub API
at runtime, then assume team-scoped role
- Repos not in any team get a clear error with setup instructions
- Platform CI: sync-registered-teams.py replaces sync-registered-repos.py
Scripts:
- Add resolve-team.sh: queries /repos/{repo}/teams API
- Add sync-registered-teams.py: lists org teams for tfvars
- Remove sync-registered-repos.py: no longer needed
No manual registration needed. Teams register in registry, add repos
to their GitHub team, and CI works automatically.
Terraform Plan🚧 Changes detected — Plan: 8 to add, 1 to change, 8 to destroy. Plan outputLLM ReviewRisk: 🟡 MEDIUM Terraform plan refactors CI/CD IAM roles from app-specific to team-based structure, removing platform-test-app roles and creating new platform-test-team roles with broader ECR permissions.
|
Alexanderamiri
added a commit
that referenced
this pull request
May 9, 2026
## Summary
Replaces per-repo IAM roles (`javabin-ci-app-{repo}`,
`javabin-ci-deploy-{repo}`) with per-team roles
(`javabin-ci-team-{team}`, `javabin-ci-deploy-{team}`).
**Before:** Every app repo needed to be in a `registered_app_repos` list
→ IAM role created per repo → sync mechanism needed to discover repos.
**After:** IAM roles are per-team. Repos are discovered at CI runtime
via GitHub API (`/repos/{repo}/teams`). Adding a repo to a GitHub team
is all that's needed — no Terraform changes, no sync.
### Security model
- OIDC trust: `repo:javaBin/*:*` (any org repo) BUT `job_workflow_ref`
pinned to our platform workflows on main
- Only code running through our controlled `tf-plan.yml`,
`docker-build.yml`, `ecs-deploy.yml` can assume these roles
- ABAC: resources must be tagged with `team={team-slug}` — teams can
only touch their own resources
- Permission boundary still applied to all roles
### Flow
1. Team registers in registry → GitHub team created
2. Dev adds repo to GitHub team (GitHub UI)
3. Dev pushes → workflow resolves team → assumes
`javabin-ci-team-{team}` → plans/applies
4. No manual registration. No repo lists. No sync delays.
## Test plan
- [ ] `terraform plan` — verify old per-repo roles destroyed, new
per-team roles created
- [ ] Test app repo CI: verify team resolution works and role assumption
succeeds
- [ ] Verify repo not in any team gets clear error message
- [ ] Verify ABAC: team role can only touch team-tagged resources
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Replaces per-repo IAM roles (
javabin-ci-app-{repo},javabin-ci-deploy-{repo}) with per-team roles (javabin-ci-team-{team},javabin-ci-deploy-{team}).Before: Every app repo needed to be in a
registered_app_reposlist → IAM role created per repo → sync mechanism needed to discover repos.After: IAM roles are per-team. Repos are discovered at CI runtime via GitHub API (
/repos/{repo}/teams). Adding a repo to a GitHub team is all that's needed — no Terraform changes, no sync.Security model
repo:javaBin/*:*(any org repo) BUTjob_workflow_refpinned to our platform workflows on maintf-plan.yml,docker-build.yml,ecs-deploy.ymlcan assume these rolesteam={team-slug}— teams can only touch their own resourcesFlow
javabin-ci-team-{team}→ plans/appliesTest plan
terraform plan— verify old per-repo roles destroyed, new per-team roles created